On the main login page for the webmail can you log out of the default account? If you can, then log out and look and see that “remember this id and password” is not checked. If it is, uncheck it.
I have seen this when webmail is serviced directly by the Exchange CAS server. If an ISA server is used to publish the webmail, then manual authentication is needed. Are there other CAS servers in the environment (if this is Exchange – you did not provide the application environment details)? If so, can the user try logging into another CAS server in the environment? If their mailbox is not on that server, they should be prompted for credentials.
I would either use Firefox which does not pass thru local credentials to internal resouces or disable with IE (Internet Options, Advanced Tab), just uncheck the “Enable Integrated Windows Authentication”.
Using the “Log Off” button says the client is logged out, but whenever subsequent navigation to webmail is initiated, the default account is automatically loaded, even if accessed immediately after logging out. I have a computer on the domain, and yet I do not experience this problem. This is an exchange e-mail system. I will have to look into specific servers.